CVE-2025-66556 — Nextcloud talk allows participants to blindly delete poll drafts of other users by ID
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other partici…
Published: 2025-12-05 · CVSS: 3.5 · CVSS 3.1
Nextcloud talk is a video & audio conferencing app for Nextcloud. Prior to 20.1.8 and 21.1.2, a participant with chat permissions was able to delete poll drafts of other participants within the conversation based on their numeric ID. This vulnerability is fixed in 20.1.8 and 21.1.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7